Autoguess: A Tool for Finding Guess-and-Determine Attacks and Key Bridges

Hadipour, Hosein; Eichlseder, Maria

doi:10.1007/978-3-031-09234-3_12

Cited by 8 publications

(10 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In both versions, the states are arranged as 4 × 4-array, where the size of each cell is 4-bit in SKINNY-64 case and 8-bit in SKINNY-128 case. The input state of rth round is denoted by [11] S r [12] S r [13] S r [14] S r [15] ⎞ ⎟ ⎟ ⎠ .…”

Section: Brief Description Of Skinny Block Ciphermentioning

confidence: 99%

“…-1 in {P 0 [S 9 [15]], P 0 [S 10 [2]], P 0 [S 10 [14]]} as P 0 [S 9 [15]] = P 0 [S 10 [2]] ⊕ P 0 [S 10 [14]], -1 in {P 0 [S 9 [9]], P 0 [S 10 [7]], P 0 [S 10 [15]]} as P 0 [S 9 [9]] = P 0 [S 10 [7]]⊕P 0 [S 10 [15]], -2 in {P 0 [S 10 [8]], P 0 [S 10 [15]], P 0 [S 11 [2]], P 0 [S 11 [6]], P 0 [S 11 [14]]} as P 0 [S 10 [8]] = P 0 [S 11 [6]] ⊕ P 0 [S 11 [14]], P 0 [S 10 [15]] = P 0 [S 11 [2]] ⊕ P 0 [S 11 [14]], -1 in {P 0 [S 11 [11]], P 0 [S 11 [14]], P 0 [S 12 [1]], P 0 [S 12 [5]]} as P 0 [S 11 [11]] ⊕ P 0 [S 11 [14]] = P 0 [S 12 [1]] ⊕ P 0 [S 12 [5]].…”

Section: Precomputation Phasementioning

confidence: 99%

See 1 more Smart Citation

Exploiting Non-full Key Additions: Full-Fledged Automatic Demirci-Selçuk Meet-in-the-Middle Cryptanalysis of SKINNY

Shi

Sun

Song

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The Demirci-Selçuk meet-in-the-middle (DS-MITM) attack is a sophisticated variant of differential attacks. Due to its sophistication, it is hard to efficiently find the best DS-MITM attacks on most ciphers except for AES. Moreover, the current automatic tools only capture the most basic version of DS-MITM attacks, and the critical techniques developed for enhancing the attacks (e.g., differential enumeration and key-dependent-sieve) still rely on manual work. In this paper, we develop a full-fledged automatic framework integrating all known techniques (differential enumeration, key-dependent-sieve, and key bridging, etc.) for the DS-MITM attack that can produce key-recovery attacks directly rather than only search for distinguishers. Moreover, we develop a new technique that is able to exploit partial key additions to generate more linear relations beneficial to the attacks. We apply the framework to the SKINNY family of block ciphers and significantly improved results are obtained. In particular, all known DS-MITM attacks on the respective versions of SKINNY are improved by at least 2 rounds, and the data, memory, or time complexities of some attacks are reduced even compared to previous best attacks penetrating less rounds.

show abstract

Section: Brief Description Of Skinny Block Ciphermentioning

confidence: 99%

Section: Precomputation Phasementioning

confidence: 99%

Exploiting Non-full Key Additions: Full-Fledged Automatic Demirci-Selçuk Meet-in-the-Middle Cryptanalysis of SKINNY

Shi

Sun

Song

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…In accordance with the formalism employed in the present paper in the case of the A5/1 generator we considered the problem of inversion of function f A5/1 : {0, 1} 64 → {0, 1} 64 . ASG generator was studied in two variants earlier analyzed in papers [22], [31] using the SAT solvers: here we mean the functions f ASG 72 : {0, 1} 72 → {0, 1} 76 and f ASG 96 : {0, 1} 96 → {0, 1} 112 . For the Bivium cipher we considered the state recovery attack in the same formulation as in papers [32], [33], [34] and some others.…”

Section: A Considered Functions and Their Encodingsmentioning

confidence: 99%

“…In Table 5 and Table 6 we show the results of the automatic construction of linearizing set attacks on variants of ASG with key lengths 72 and 96 bits (ASG 72 and ASG 96 , respectively). Recall, that we considered the inversion problems for functions f ASG 72 : {0, 1} 72 → {0, 1} 76 and f ASG 96 : {0, 1} 96 → {0, 1} 112 . For ASG 72 and ASG 96 the keystream sizes were picked from [31].…”

Section: Linearizing Set Attacks On the Alternating Step Generatormentioning

confidence: 99%

See 1 more Smart Citation

Using Linearizing Sets to Solve Multivariate Quadratic Equations in Algebraic Cryptanalysis

Semenov,

Antonov,

Kochemazov

et al. 2023

IEEE Access

View full text Add to dashboard Cite

In this paper we describe a class of cryptographic guess-and-determine attacks which is based on the notion of a linearizing set. A linearizing set-based attack is applied to a system of Multivariate Quadratic equations (MQ) over GF(2) field, which encodes how a considered cryptographic function works. By substituting into such MQ system a random (in some strict sense) assignment of variables from a linearizing set we aim to transform the system into a linear one. We introduce a probability of such an event and call it a probability of linearization. Then we describe a guess-and-determine attack, the hardness of which can be expressed via a probability of linearization. To estimate the latter it is possible to use a simple Monte Carlo algorithm. Also we describe a technique that allows to augment a considered MQ system by new linear equations and to construct a new MQ system, for which the probability of linearization is usually larger than that for an original one. For this purpose we apply a SAT oracle to a Boolean formula that is naturally associated with a considered MQ system. Finally, we reduce the problem of searching for a linearizing set that yields the best effectiveness of a constructed guess-and-determine attack to a pseudo-Boolean optimization problem, which can be solved using metaheuristic optimization algorithms. The important consequence of this is that this way we can construct guess-and-determine attacks automatically by solving the corresponding optimization problem. In the computational experiments we used the proposed methodology to construct attacks on several well-known stream ciphers. The runtime estimations of some of the attacks make it possible to implement them in reasonable time.INDEX TERMS Algebraic cryptanalysis, guess-and-determine attack, system of multivariate quadratic equations, Boolean satisfiability, pseudo-Boolean optimization, evolutionary algorithm.

show abstract

Finding the Impossible: Automated Search for Full Impossible-Differential, Zero-Correlation, and Integral Attacks

Hadipour

Sadeghi

Eichlseder

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Autoguess: A Tool for Finding Guess-and-Determine Attacks and Key Bridges

Cited by 8 publications

References 16 publications

Exploiting Non-full Key Additions: Full-Fledged Automatic Demirci-Selçuk Meet-in-the-Middle Cryptanalysis of SKINNY

Exploiting Non-full Key Additions: Full-Fledged Automatic Demirci-Selçuk Meet-in-the-Middle Cryptanalysis of SKINNY

Using Linearizing Sets to Solve Multivariate Quadratic Equations in Algebraic Cryptanalysis

Finding the Impossible: Automated Search for Full Impossible-Differential, Zero-Correlation, and Integral Attacks

Contact Info

Product

Resources

About